bridg-trezr-en[.]pages[.]dev

PhishDestroy identifies an active phishing domain, bridg-trezr-en.pages.dev, impersonating the legitimate Trezor hardware wallet service to harvest user credentials and cryptocurrency assets. This malicious site is hosted on Cloudflare’s infrastructure (IP: 172.66.44.52) and leverages a Google Trust Services SSL certificate to appear legitimate. While currently undetected by VirusTotal (2/95 engines), the domain represents a high-risk threat to cryptocurrency users seeking secure wallet access.

This domain was flagged under investigation for its role in a generic phishing campaign designed to deceive victims into surrendering sensitive recovery phrases or wallet passwords. PhishDestroy’s analysis reveals it was registered through Cloudflare, Inc., a common tactic among threat actors to obscure their true origins. The absence of detections on VirusTotal (2/95) underscores the need for proactive user vigilance, as automated tools may not yet recognize this threat. The domain’s Cloudflare Pages origin (pages.dev) is frequently abused for phishing due to its legitimate appearance and evasion of traditional blocklists.

If you visited bridg-trezr-en.pages.dev or entered any wallet credentials, immediately revoke access to your Trezor device via the official Trezor Suite or website. Transfer all assets to a newly generated wallet address via the legitimate app. Scan your devices for malware using reputable antivirus software like Malwarebytes or Windows Defender, and enable two-factor authentication (2FA) on all crypto accounts. Report the domain to PhishDestroy and your wallet provider to aid in takedown efforts. Never use links from emails or third-party sites to access wallet services—always type the official URL (trezor.io) directly into your browser.